I used to be the person companies called after they got hacked. And I noticed something early on. The hack almost never sank them. The cover-up did. Every time, the team’s instinct was the same: wait until we know more, wait until we're sure, wait until we have the perfect statement, etc. And some of the biggest companies in the world have learned what that waiting costs. In 2016, Uber got hacked. Instead of telling anyone, it paid the hackers $100K to delete the data and stay quiet, and labeled it a bug bounty. The truth came out a year later. Uber paid $148M to settle with all 50 states, and its former security chief was criminally convicted. That same year, Yahoo revealed that a 2014 breach had exposed 500M accounts. The news landed in the middle of Verizon buying the company. Verizon cut $350M off the price. And in 2017, Equifax discovered a breach affecting over 140M Americans, then waited 40 days to tell the public. During that window, an executive who'd figured out what happened sold nearly $1M in stock. He went to prison for insider trading. Meanwhile, hackers don't wait. They post your data. They email your customers directly. And when customers hear it from a stranger first, that trust is gone for good. Telling customers early doesn't mean admitting fault. It can be as simple as: "We found suspicious activity. We're investigating. Here's what you should do right now. We'll update you as we learn more." On Tuesday, I'm sharing the exact framework I'd use to write that email if I were in your shoes. Follow and turn on notifications so it's there when you need it. Customers will forgive you for getting hacked. Most of them expect it by now. What they won't forgive is finding out you knew and said nothing.